Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/oxy-hq/skills/oxy-app-buildergit clone --depth 1 https://github.com/oxy-hq/skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/oxy-hq/skills/oxy-app-builder)<a href="https://agentmods.dev/rules/oxy-hq/skills/oxy-app-builder"><img src="https://agentmods.dev/badge/rules/oxy-hq/skills/oxy-app-builder.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.02418 |
| Opus 5 | $0.00000 | $0.01209 |
| Sonnet 5 | $0.00000 | $0.00484 |
| Haiku 4.5 | $0.00000 | $0.00242 |
Grade A, and why
oxy-app-builder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 412 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Oxy App Builder
Build Oxy data apps - interactive dashboards that combine data tasks with visualizations. Apps are defined in *.app.yml files.
The mental model: Task -> Output -> Display
Two app models — don't confuse them. This rule builds the declarative
*.app.ymlapp (tasks + displays, rendered byoxy serve --enterprise). The other model is a custom-code (React/Vite) app deployed withoxy publishand identified by anoxy-app.jsonmanifest at the app root.oxy-app.jsonis the deploy manifest for that path, not an alternative to*.app.yml. See theoxy-app-builderSKILL.md → "Deploying custom-code apps (oxy-app.json)".
App YAML Structure
name: app_name # snake_case identifier
description: | # Multi-line description
What this app does...
# Required: Array of tasks (min 1)
tasks:
- name: task_name # Unique, snake_case
type: execute_sql # Task type
database: clickhouse # Database to query
sql_query: | # Inline SQL
SELECT * FROM table
# Required: Array of displays (min 1)
display:
- type: table
title: "Results"
data: task_name # Reference task by name
Task Types
1. execute_sql - Direct SQL Execution
- name: sales_by_region
type: execute_sql
database: clickhouse # or: postgres, bigquery, local (DuckDB)
sql_query: |
SELECT region, SUM(amount) as total
FROM sales
GROUP BY region
Or reference a SQL file:
- name: sales_report
type: execute_sql
database: clickhouse
sql_file: queries/sales_report.sql
2. workflow - Invoke Sub-Workflow
- name: data_prep
type: workflow
src: workflows/data_prep.workflow.yml
variables:
start_date: "2024-01-01"
min_threshold: 100
Reference workflow task outputs: workflow_name.inner_task_name
3. semantic_query - Query Semantic Layer
- name: revenue_by_month
type: semantic_query
topic: sales_mrr
dimensions:
- sales.month
measures:
- sales.total_revenue
- sales.order_count
filters:
- field: sales.year
op: eq
value: 2024
orders:
- field: sales.month
direction: asc
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 412 lines · 0 tokens per session scan A 98b48b50658a
oxy-app-builder is a cursor rule published in the GitHub repository oxy-hq/skills (2 stars, last pushed 1mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,418 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
cli-error-handling
CLI command error handling patterns.
prefer-direct-imports-over-module-mocks
Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.
control-plane-descriptors
Control plane descriptor and instance implementation patterns.
family-instance-domain-actions
Family instance domain action implementation patterns.